EP3759886B1 - Passerelle à point de contrôle d'accès - Google Patents

Passerelle à point de contrôle d'accès Download PDF

Info

Publication number
EP3759886B1
EP3759886B1 EP19756785.2A EP19756785A EP3759886B1 EP 3759886 B1 EP3759886 B1 EP 3759886B1 EP 19756785 A EP19756785 A EP 19756785A EP 3759886 B1 EP3759886 B1 EP 3759886B1
Authority
EP
European Patent Office
Prior art keywords
resource
access
network
aprt
devices
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
EP19756785.2A
Other languages
German (de)
English (en)
Other versions
EP3759886A1 (fr
EP3759886A4 (fr
Inventor
German LANCIONI
Eric Donald WUEHLER
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
McAfee LLC
Original Assignee
McAfee LLC
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by McAfee LLC filed Critical McAfee LLC
Publication of EP3759886A1 publication Critical patent/EP3759886A1/fr
Publication of EP3759886A4 publication Critical patent/EP3759886A4/fr
Application granted granted Critical
Publication of EP3759886B1 publication Critical patent/EP3759886B1/fr
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0281—Proxies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general

Definitions

  • This disclosure relates in general to the field of home network security, and more particularly, though not exclusively, to a system and method for providing a gateway with access checkpoint.
  • the "Internet of things” is a term that refers loosely to the many "smart" devices that are starting to become ubiquitous in society. These devices can appear, for example, in a home or office automation scheme.
  • the loT includes physical devices and other items embedded with electronics, software, sensors, and actuators. Because these devices and items also include network connectivity, they can collect and exchange data with other devices, items, and computers.
  • US 2013/322262A1 describes a method and a device which contains a diagnostic client and a monitoring server which aim to detect connection problems and service failures of Wi-Fi hotspot (wireless access field) services and measure user experience and connection quality.
  • Wi-Fi hotspot wireless access field
  • US 2015/0012640A1 reports a method for detecting interception of data sent by the computing device to a first network resource through a communication network.
  • the first network resource corresponds to a particular domain of the communication network.
  • the method also includes determining whether the communication network is administered by the particular domain; and automatically generating a request to access the communication network that identifies a second network resource based at least in part on the determination.
  • the second network resource is configured to authenticate a user to the particular domain of the communication network.
  • the method also includes sending the request to the second network resource to access the communication network.
  • a gateway apparatus to operate on an intranet including: a hardware platform; and an access proxy engine to operate on the hardware platform and configured to: intercept an incoming packet; determine that the incoming packet is an access request directed to an access interface of a resource of the intranet; present an access checkpoint interface; receive an authentication input response; validate the authentication input response; and provide a redirection to the access interface of the device.
  • loT devices With the increasing amount of connected loT devices at home, security is becoming a challenge for users without technical expertise.
  • the home gateway or router is becoming a common point that centralizes the local network operation and security.
  • the risk of loT devices being compromised is still high, as IoT devices may not be regularly patched, and home users are often not security experts. Those users may be unaware of default or weak login credentials for network-enabled devices, and may lack the technical expertise to mitigate these security holes.
  • a user can secure home devices by manually configuring each device by changing default or weak access credentials. For example, "out of the box,” the device may connect to a wired or wireless home network and receive an Internet protocol (IP) address via dynamic hostname configuration protocol (DHCP), such as "192.168.1.27.” The user may then open a web browser and enter "https://192.168.1.27/login.html" into the address bar, and be presented with a login page. This login page may have weak default login credentials, such as "username:admin” and "password: admin.” After the user enters these default credentials, he may enter an administration portal, where he can perform a number of administrative tasks, including changing the default weak login credentials to more secure credentials.
  • IP Internet protocol
  • DHCP dynamic hostname configuration protocol
  • IP Internet protocol
  • Some manufacturers use default, standardized, blank, or other insecure login credentials by default. This can reduce the cost of manufacturing these devices, as each manufactured device has identical login credentials. It is anticipated by these manufacturers that the end user will change the default login credentials to something more secure upon setting up the device. But if the user fails to do so, the device may be exposed to potential attacks. This problem may be exacerbated by the fact that many manufacturers use the same or similar default login credentials, along with similar access interfaces.
  • a device may be configured via a router with access point (AP) isolation, which allows devices to connect to the Internet but without the capability of connecting to other local devices.
  • AP isolation allows devices to connect to the Internet but without the capability of connecting to other local devices. This configuration mitigates some of the risk, but does not eliminate the problem of the device being compromised from outside the local network.
  • AP isolation is not something that a common end user will perform, as it requires technical knowledge. AP isolation may also not be appropriate for devices that require both Internet and local network access.
  • Embodiments of the home gateway of the present specification lower the risk of an IoT device being compromised by attackers, while at the same time maintaining an acceptable level of convenience and transparency for the end user.
  • embodiments provide an access security checkpoint enforced by a home gateway router before the user interacts with a potentially weak IoT device, including a device that may still have the default login credentials or that may otherwise be flagged as sensitive.
  • a home gateway router detects and secures potentially weak devices in the network. This may include detecting a newly added device and setting up appropriate access rules for that device. This may also include intercepting incoming access requests to resources in these devices, and adding an access checkpoint rule that may be configured according to three primary analysis vectors: session, context, and severity.
  • Embodiments reduce the probability of home devices being compromised by attacks that are aimed at weak login interfaces.
  • the home gateway may analyze an incoming resource access request and provide a tiered authentication checkpoint before granting access to the device's resource.
  • the home gateway may have the ability to enforce access policies through the access checkpoint, regardless of the capabilities of the target device. This can be especially beneficial for legacy devices, which may lack any security mechanism, or which may have had security tacked on as an afterthought.
  • the router intercepts the call (e.g., via hypertext transfer protocol (HTTP) or HTTP secure (HTTPS)) and determines if the request requires intervention based on the current access context. If intervention is required, the router returns an access checkpoint resource that requires the user to authenticate with the router, itself. For example, the user may be required to enter the router username and password. Note that the router username and password is a nonlimiting example, and in other cases, the router could be configured to require per-device username and password combinations to avoid a single point of failure. Furthermore, if additional security is desired, further authentication could include two-factor authentication, biometric authentication, or any other security mechanism consistent with the desired security of the device.
  • HTTP hypertext transfer protocol
  • HTTPS HTTP secure
  • the router redirects to the original IoT device resource, for example, by directing the user to the device login page.
  • the user may then be required to enter the default or weak login credentials for the device.
  • the home gateway could enter those credentials once the user is successfully authenticated to the home gateway, and thus send the user directly to the administration interface for the device.
  • This tiered access may be ruled by a session attached to a particular access context, which balances convenience of the user with the concern of maintaining a reasonable level of security for the device.
  • Embodiments of the home gateway described herein add "lifeguard access control" to potentially weak IoT device resources such as HTTP login interfaces. Thus, even if the user does not change the default credentials, an attack is much less likely.
  • the access checkpoint takes into consideration the current network context (e.g., the session, request, origin, and severity of the resource, by way of nonlimiting example)
  • the solution adapts to the convenience of the user while maintaining additional security. For example, if the user accesses the same resource three times within an hour, the access checkpoint may be activated only the first time. This reduces the friction introduced by the router in the interaction process between the user and the IoT device.
  • the home gateway can provide this additional security when intercepting access requests, thus adding a consistent security protocol across all home devices.
  • the router analyzes the request to determine if the request is an access request (for example, the request is directed to a known login resource).
  • the home gateway determines if the request is an access interface by, for example, examining the request and the resource content, which may include the resource path (e.g., 192.168.1.27/main/login.HTML), hypertext markup language (HTML) tags (for example, user login, and/or password fields), resource type and parameters, and HTTP headers and ports, by way of nonlimiting example.
  • the resource may be added to an access proxy rules table (APRT).
  • APRT access proxy rules table
  • access and configuration interfaces include, by way of nonlimiting example, secure shell (SSH), telnet, and shared desktops such as X11 or remote desktop protocol (RDP).
  • SSH secure shell
  • telnet shared desktops
  • RDP remote desktop protocol
  • embodiments of the present specification may include a discovery function, wherein newly added IoT resources are automatically discovered and checked for weak or default login credentials. This can be accomplished, for example, by determining that a device has been newly attached to the network, and scanning the device for common or known login interfaces. For example, the device may be scanned for common interfaces such as login.html, login.aspx, login.php, main.html, main.aspx, main.php, default.html, default.aspx, default.php, or other commonly used names.
  • the page may be scanned for login fields, and the home gateway may attempt to log in via common or standardized credentials, such as blank login credentials, login credentials with “admin” as both the username and password, credentials with username “admin” and password “password,” or credentials wherein the username is the device name and the password is “admin,” "password,” or blank.
  • common or standardized credentials such as blank login credentials, login credentials with "admin” as both the username and password, credentials with username “admin” and password “password,” or credentials wherein the username is the device name and the password is “admin,” "password,” or blank.
  • TABLE 1 is an example of an APRT that may be used in an embodiment of a home gateway.
  • Fields in Table 1 include resource, device, session, severity, and policy.
  • Table 1 Example APRT Entries Resource Device Session Severity Policy /login.htm DVR 112B (192.168.1.15) N/A 3 Default /admin/index.php Camera DLink-101A(192.168.1.7 ) eyJhbGciOiJIUzI 5 (3) Login attempts maximum (30') Maximum session time :9191 Printer HP1102 (192.168.1.5) N/A 4 Default :5001 NAS DS213 (192.168.1.3) yRQYnWzskCZU 5 Local access only
  • the resource field may identify resources that are available on a particular device for the login interface. For example, these can specify a path, interface, or port number that identifies a particular access request as a login request.
  • the device field identifies the device, for example, in terms of both a name and an IP address.
  • the device field could also include a media access control (MAC) address, which may be useful if it is desirable to maintain consistency across changes in IP address.
  • MAC media access control
  • the session field may be a field in which a session identifier for an existing session is stored.
  • a session may include a timeout which may have a default value, and/or which may be user-configurable. For example, a session may be maintained for one hour, during which time the user accessing the resource does not need to continue to authenticate to the home gateway to continue accessing the resource.
  • the severity field may be a scaler that indicates the potential harm or severity of an unauthorized access to the device.
  • the severity field may be useful in crafting a policy, such as the strength of authentication required, the availability and/or length of a session, and other factors that may affect security. This can include the policy field.
  • a higher severity number indicates a higher risk, and thus may correspond to a higher security requirement.
  • a lower severity indicates a lower risk and may thus correspond to a lower security requirement.
  • the policy field may indicate a policy for the resource.
  • a default policy may be defined, with a default security requirement and a default session length.
  • greater security requirements may be specified, such as a maximum number of unsuccessful login attempts before access to the device is locked out for a particular time, and a maximum session time.
  • the policy could also include locality policies, for example, whether the device can be accessed only via the local network, only via an extranet, or via both.
  • the home gateway intercepts the request to the resource and stores its information to redirect to the resource later.
  • the home gateway then returns an access checkpoint interface.
  • the access checkpoint may be, for example, the same interface used by the router to log into the network administration panel. However, this is a nonlimiting example, and a per-device access checkpoint could also be used.
  • the access checkpoint may require the user to authenticate before proceeding to the target resource.
  • the router may redirect to the original resource the user attempted to reach.
  • the APRT may have stored therein the known login credentials for the resource, in which case the home gateway may perform authentication to the device. This may remove an extra step for the user, though this is optional, as in some cases, it is desirable to provide a multi-tiered access, wherein the user must authenticate both to the home gateway and to the device itself.
  • the home gateway After redirecting the user, the home gateway creates a session token for the resource and stores the session token, for example, in the APRT.
  • the session token may include a particular access scope (for example, local access only) and an expiration policy (for example, one hour). While the scope remains the same, the session token may be used by the home gateway to validate further interactions between the user and the resource, so that the access checkpoint is not repeatedly presented to the user. For example, if the user needs to access the IP camera three times within one hour, the access checkpoint is presented only the first time. If the access scope changes (for example, an access attempt comes in from an extranet), the router may invalidate the session token and the process may reset to intercept the request and redirect the user to the access checkpoint.
  • the access scope changes for example, an access attempt comes in from an extranet
  • the home gateway may implement and enforce different policies. These policies can indicate the number of unsuccessful login attempts, a maximum session time, a local intranet versus extranet access policy, or similar. Thus, even if the device being accessed does not support the security policies, the access checkpoint may supply the policies transparently to the user.
  • an intranet should be understood broadly to encompass any network or combination of networks that are or can be managed by a particular entity or enterprise.
  • One attribute of an intranet is its division from an external "extranet” (e.g., the Internet). In common practice, the intranet is controlled by one or more gateways that divide the intranet from the extranet.
  • Devices within the intranet may have relatively more privileged access to the intranet than devices that reside solely on the extranet. Note, however, that the division need not be absolute. For example, a user operating on the extranet may use a virtual private network (VPN) client to proxy into the network, and thus may gain full or partial intranet privileges despite operating initially from the extranet.
  • VPN virtual private network
  • the home gateway may also attempt to pre-populate the table instead of waiting for each incoming request to be analyzed.
  • the system attempts to discover all devices and associated resources on the network. For each resource, the system may simulate several logins using a dictionary of common default or weak credentials. This process may be executed periodically, but with low frequency, so that login policies are not disrupted.
  • the process may be performed when the home gateway is first connected to the home network, and then may be repeated only when a new device is discovered on the network. If login policies are disrupted, disrupted device resources may be flagged with high severity and added to the APRT. This process of simulating login attempts may be performed similar to how automation tools work.
  • a home network and home automation are provided as nonlimiting and illustrative examples only.
  • the IoT devices described herein are provided by way of example, and other IoT devices may be used.
  • a home gateway is provided as an illustrative example of an embodiment of the teachings of the present specification. However, this example is intended to be nonlimiting. The teachings of this specification could also be applied to enterprises or other networks, and the examples discussed herein should be understood to encompass such alternative embodiments.
  • FIGURES A system and method for providing a gateway with access checkpoint will now be described with more particular reference to the attached FIGURES. It should be noted that throughout the FIGURES, certain reference numerals may be repeated to indicate that a particular device or block is wholly or substantially consistent across the FIGURES. This is not, however, intended to imply any particular relationship between the various embodiments disclosed.
  • a genus of elements may be referred to by a particular reference numeral ("widget 10"), while individual species or examples of the genus may be referred to by a hyphenated numeral ("first specific widget 10-1" and "second specific widget 10-2").
  • FIGURE 1 is a network-level diagram of a home network 100, according to one or more examples of the present specification.
  • home network 100 may be a "smart home" with various Internet of things (IoT) devices that provide home automation or other services.
  • IoT Internet of things
  • Home network 100 is provided herein as an illustrative and nonlimiting example of a system that may employ and benefit from the teachings of the present specification. But it should be noted that the teachings may also be applicable to many other entities including, by way of nonlimiting example, an enterprise, data center, telecommunications provider, government entity, or other organization.
  • one or more users 120 operate one or more client devices 110.
  • a single user 120 and single client device 110 are illustrated here for simplicity, but a home or enterprise may have multiple users, each of which may have multiple devices.
  • Client devices 110 may be communicatively coupled to one another and to other network resources via home network 170.
  • Home network 170 may be any suitable network or combination of one or more networks operating on one or more suitable networking protocols, including a local area network, an intranet, a virtual network, a wide area network, a wireless network, a cellular network, or the Internet (optionally accessed via a proxy, virtual machine, or other similar security mechanism) by way of nonlimiting example.
  • Home network 170 may also include one or more servers, firewalls, routers, switches, security appliances, antivirus servers, or other network devices, which may be single-purpose appliances, virtual machines, containers, or functions running on client devices 110.
  • home network 170 is shown as a single network for simplicity, but in some embodiments, home network 170 may include any number of networks, such as one or more intranets connected to the Internet. Home network 170 may also provide access to an external network, such as the Internet, via external network 172. External network 172 may similarly be any suitable type of network.
  • Home network 170 may connect to the Internet via a home gateway 108, which may be responsible, among other things, for providing a logical boundary between home network 172 and external network 170.
  • Home network 170 may also provide services such as dynamic host configuration protocol (DHCP), gateway services, router services, and switching services, and may act as a security portal across home boundary 104.
  • DHCP dynamic host configuration protocol
  • Home network 100 may also include a number of discrete IoT devices, which in contemporary practice are increasing regularly.
  • home network 100 may include IoT functionality to control lighting 132, thermostats or other environmental controls 134, a home security system 136, and any number of other devices 140.
  • Other devices 140 may include, as illustrative and nonlimiting examples, network attached storage (NAS), computers, printers, smart televisions, smart refrigerators, smart vacuum cleaners and other appliances, and network connected vehicles.
  • NAS network attached storage
  • Home network 100 may communicate across home boundary 104 with external network 172.
  • Home boundary 104 may represent a physical, logical, or other boundary.
  • External network 172 may include, for example, websites, servers, network protocols, and other network-based services.
  • an attacker 180 (or other similar malicious or negligent actor) also connects to external network 172.
  • a security services provider 190 may provide services to home network 100, such as security software, security updates, network appliances, or similar.
  • McAfee, Inc. provides a comprehensive suite of security services that may be used to protect home network 100.
  • attacker 180 is a malware author whose goal or purpose is to cause malicious harm or mischief, for example, by injecting malicious object 182 into client device 110.
  • malicious object 182 gains access to client device 110, it may try to perform work such as social engineering of user 120, a hardware-based attack on client device 110, modifying storage 150 (or volatile memory), modifying client application 112 (which may be running in memory), or gaining access to home resources.
  • attacks may also be directed at IoT objects.
  • IoT objects can introduce new security challenges, as they may be highly heterogeneous, and in some cases may be designed with minimal or no security considerations. To the extent that these devices have security, it may be added on as an afterthought. Thus, IoT devices may in some cases represent new attack vectors for attacker 180 to leverage against home network 170.
  • Malicious harm or mischief may take the form of installing root kits or other malware on client devices 110 to tamper with the system, installing spyware or adware to collect personal and commercial data, defacing websites, operating a botnet such as a spam server, or simply to annoy and harass users 120.
  • one aim of attacker 180 may be to install his malware on one or more client devices 110 or any of the IoT devices described.
  • malicious software includes any security object configured to provide unwanted results or do unwanted work.
  • malware objects will be executable objects, including, by way of nonlimiting examples, viruses, Trojans, zombies, rootkits, backdoors, worms, spyware, adware, ransomware, dialers, payloads, malicious browser helper objects, tracking cookies, loggers, or similar objects designed to take a potentially-unwanted action, including, by way of nonlimiting example, data destruction, covert data collection, browser hijacking, network proxy or redirection, covert tracking, data logging, keylogging, excessive or deliberate barriers to removal, contact harvesting, and unauthorized self-propagation.
  • attacker 180 may also want to commit industrial or other espionage, such as stealing classified or proprietary data, stealing identities, or gaining unauthorized access to enterprise resources.
  • attacker 180's strategy may also include trying to gain physical access to one or more client devices 110 and operating them without authorization, so that an effective security policy may also include provisions for preventing such access.
  • a software developer may not explicitly have malicious intent, but may develop software that poses a security risk.
  • a well-known and often-exploited security flaw is the so-called buffer overrun, in which a malicious user is able to enter an overlong string into an input form and thus gain the ability to execute arbitrary instructions or operate with elevated privileges on a computing device.
  • Buffer overruns may be the result, for example, of poor input validation or use of insecure libraries, and in many cases arise in nonobvious contexts.
  • a developer contributing software to an application repository or programming an IoT device may inadvertently provide attack vectors for attacker 180. Poorly-written applications may also cause inherent problems, such as crashes, data loss, or other undesirable behavior. Because such software may be desirable itself, it may be beneficial for developers to occasionally provide updates or patches that repair vulnerabilities as they become known. However, from a security perspective, these updates and patches are essentially new objects that must themselves be validated.
  • Home network 100 may contract with or subscribe to a security services provider 190, which may provide security services, updates, antivirus definitions, patches, products, and services.
  • a security services provider 190 may provide security services, updates, antivirus definitions, patches, products, and services.
  • McAfee ® , Inc. is a nonlimiting example of such a security services provider that offers comprehensive security and antivirus solutions.
  • security services provider 190 may include a threat intelligence capability such as the global threat intelligence (GTI TM ) database provided by McAfee Inc.
  • Security services provider 190 may update its threat intelligence database by analyzing new candidate malicious objects as they appear on client networks and characterizing them as malicious or benign.
  • FIGURE 2 is a block diagram illustrating additional features of a home network, such as a smart home, according to one or more examples of the present specification.
  • a plurality of IoT devices 206 are communicatively coupled to a home gateway 208.
  • Home gateway 208 services an intranet 270, and may also communicatively couple intranet 270 to an extranet 272.
  • Intranet 270 may be separated from extranet 272 by a firewall 212, which may be a separate appliance, or which may be a built-in function of home gateway 208.
  • Home gateway 208 may have an APRT as illustrated herein, which may include rules for providing authentication when a user attempts to access a login interface of an IoT device 206.
  • Home gateway 208 may also provide, for example, port forwarding, whereby certain access interfaces of IoT devices 206 are accessible via extranet 272.
  • port forwarding whereby certain access interfaces of IoT devices 206 are accessible via extranet 272.
  • home gateway 208 enables a user who is not connected to home gateway 208 to control functions of those IoT devices. This could be used so that a user, for example, could set the thermostat or change lighting while at work, so that the home is in a comfortable condition when she arrives home.
  • home gateway 208 can service incoming requests both from intranet 270 and extranet 272.
  • home gateway 208 may be configured to discriminate between incoming requests on intranet 270 and extranet 272. This can be useful in crafting policies for certain login interfaces. For example, some interfaces may only be accessible via intranet 270, others may be accessible only via extranet 272, and others may be accessible via either one. Furthermore, additional limits could be placed, such as context-sensitive limits, so that incoming requests from extranet 272 may be permissible only during certain times, and only under certain conditions. Many other configurations are possible.
  • Home gateway 208 may be configured to periodically scan intranet 270 for newly added devices so that it can automatically configure those devices when they are discovered. However, in some cases, home gateway 208 provides other features such as a router which may have a DHCP server. Thus, when a new device requests an address via DHCP, home gateway 208 may take that opportunity instead to configure the device. As discussed above, configuring the new device may take the form, for example, of using a dictionary of common access interfaces, default passwords, and default usernames to populate the APRT.
  • FIGURE 3 is a block diagram illustrating a hardware platform 300, according to one or more examples of the present specification.
  • Hardware platform 300 may represent any suitable computing device.
  • a "computing device” may be or comprise, by way of nonlimiting example, a computer, workstation, server, mainframe, virtual machine (whether emulated or on a "bare-metal" hypervisor), network appliance, container, IoT device, embedded computer, embedded controller, embedded sensor, personal digital assistant, laptop computer, cellular telephone, IP telephone, smart phone, tablet computer, convertible tablet computer, computing appliance, receiver, wearable computer, handheld calculator, or any other electronic, microelectronic, or microelectromechanical device for processing and communicating data.
  • Any computing device may be designated as a host on the network. Each computing device may refer to itself as a "local host,” while any computing device external to it may be designated as a "remote host.”
  • client devices 110, home gateway 108, and the IoT devices illustrated in FIGURE 1 may all be examples of devices that run on a hardware platform such as hardware platform 300.
  • FIGURE 3 presents a view of many possible elements that may be included in a hardware platform, but it should be understood that not all of these are necessary in every platform, and platforms may also include other elements.
  • peripheral interface 340 may be an essential component in a user-class device to provide input and output, while it may be completely unnecessary in a virtualized server or hardware appliance that communicates strictly via networking protocols.
  • hardware platform 300 provides a processor 310 connected to a memory 320 and other system resources via one or more buses, such a system bus 370-1 and a memory bus 370-3.
  • hardware platform 300 includes a storage 350, network interface 360, and peripheral interface 340.
  • This architecture is provided by way of example only, and is intended to be nonexclusive and nonlimiting. Furthermore, the various parts disclosed are intended to be logical divisions only, and need not necessarily represent physically separate hardware and/or software components.
  • Certain computing devices provide main memory 320 and storage 350, for example, in a single physical memory device, and in other cases, memory 320 and/or storage 350 are functionally distributed across many physical devices.
  • each logical block disclosed herein is broadly intended to include one or more logic elements configured and operable for providing the disclosed logical operation of that block.
  • logic elements may include hardware, external hardware (digital, analog, or mixed-signal), software, reciprocating software, services, drivers, interfaces, components, modules, algorithms, sensors, components, firmware, hardware instructions, microcode, programmable logic, or objects that can coordinate to achieve a logical operation.
  • a "processor” may include any combination of logic elements operable to execute instructions, whether loaded from memory, or implemented directly in hardware, including, by way of nonlimiting example, a microprocessor, digital signal processor, field-programmable gate array, graphics processing unit, programmable logic array, application-specific integrated circuit, or virtual machine processor.
  • a multi-core processor may be provided, in which case processor 310 may be treated as only one core of a multi-core processor, or may be treated as the entire multi-core processor, as appropriate.
  • one or more co-processors may also be provided for specialized or support functions.
  • Processor 310 may be communicatively coupled to devices via a system bus 370-1.
  • a "bus" includes any wired or wireless interconnection line, network, connection, bundle, single bus, multiple buses, crossbar network, single-stage network, multistage network or other conduction medium operable to carry data, signals, or power between parts of a computing device, or between computing devices. It should be noted that these uses are disclosed by way of nonlimiting example only, and that some embodiments may omit one or more of the foregoing buses, while others may employ additional or different buses. Common buses include peripheral component interconnect (PCI) and PCI express (PCIe), which are based on industry standards. However, system bus 370-1 is not so limited, and may include any other type of bus.
  • PCI peripheral component interconnect
  • PCIe PCI express
  • interconnects evolve, the distinction between a system bus and the network fabric is sometimes blurred.
  • access to some resources may be provided over the fabric, which may be or include, by way of nonlimiting example, Intel ® Omni-Path TM Architecture (OPA), TrueScale TM , Ultra Path Interconnect (UPI) (formerly called QPI or KTI), FibreChannel, Ethernet, FibreChannel over Ethernet (FCoE), InfiniBand, PCI, PCIe, or fiber optics, to name just a few.
  • OPA Intel ® Omni-Path TM Architecture
  • UPI Ultra Path Interconnect
  • FibreChannel Ethernet
  • FibreChannel over Ethernet FCoE
  • InfiniBand PCI, PCIe, or fiber optics
  • processor 310 is communicatively coupled to memory 320 via memory bus 370-3, which may be, for example, a direct memory access (DMA) bus, though other memory architectures are possible, including ones in which memory 320 communicates with processor 310 via system bus 370-1 or some other bus.
  • memory bus 370-3 may include remote direct memory access (RDMA), wherein processor 310 accesses disaggregated memory resources via DMA or DMA-like interfaces.
  • RDMA remote direct memory access
  • memory 320 is disclosed as a single logical block, but in a physical embodiment may include one or more blocks of any suitable volatile or nonvolatile memory technology or technologies, including, for example, double data rate random-access memory (DDR RAM), static random-access memory (SRAM), dynamic random-access memory (DRAM), persistent random-access memory (PRAM), or other similar persistent fast memory, cache, Layer 1 (L1) or Layer 2 (L2) memory, on-chip memory, registers, flash, read-only memory (ROM), optical media, virtual memory regions, magnetic or tape memory, or similar.
  • DDR RAM double data rate random-access memory
  • SRAM static random-access memory
  • DRAM dynamic random-access memory
  • PRAM persistent random-access memory
  • memory 320 may comprise a relatively low-latency volatile main memory
  • storage 350 may comprise a relatively higher-latency nonvolatile memory.
  • memory 320 and storage 350 need not be physically separate devices, and in some examples may represent simply a logical separation of function. It should also be noted that although DMA is disclosed by way of nonlimiting example, DMA is not the only protocol consistent with this specification, and that other memory architectures are available.
  • Storage 350 may be any species of memory 320, or may be a separate device.
  • Storage 350 may include one or more nontransitory computer-readable mediums, including, by way of nonlimiting example, a hard drive, solid-state drive, external storage, microcode, hardware instructions, redundant array of independent disks (RAID), network attached storage (NAS), optical storage, tape drive, backup system, cloud storage, or any combination of the foregoing.
  • Storage 350 may be, or may include therein, a database or databases or data stored in other configurations, and may include a stored copy of operational software such as operating system 322 and software portions, if any, of operational agents 324, accelerators 330, or other engines. Many other configurations are also possible, and are intended to be encompassed within the broad scope of this specification.
  • hardware platform 300 may include an appropriate operating system, such as Microsoft Windows, Linux, Android, Mac OSX, Apple iOS, Unix, or similar. Some of the foregoing may be more often used on one type of device than another. For example, desktop computers or engineering workstations may be more likely to use one of Microsoft Windows, Linux, Unix, or Mac OSX. Laptop computers, which are usually a portable, off-the-shelf device with fewer customization options, may be more likely to run Microsoft Windows or Mac OSX. Mobile devices may be more likely to run Android or iOS. However, these examples are not intended to be limiting.
  • hardware platform 300 may be configured for virtualization or containerization, in which case it may also provide a hypervisor, virtualization platform, virtual machine manager (VMM), orchestrator, containerization platform, or other infrastructure to provide flexibility in allocating resources.
  • VMM virtual machine manager
  • Network interface 360 may be provided to communicatively couple hardware platform 300 to a wired or wireless network or fabric.
  • a "network,” as used throughout this specification, may include any communicative platform operable to exchange data or information within or between computing devices, including, by way of nonlimiting example, a local network, a switching fabric, an ad-hoc local network, an Internet architecture providing computing devices with the ability to electronically interact, a plain old telephone system (POTS), which computing devices could use to perform transactions in which they may be assisted by human operators or in which they may manually key data into a telephone or other suitable electronic equipment, any packet data network (PDN) offering a communications interface or exchange between any two nodes in a system, or any local area network (LAN), metropolitan area network (MAN), wide area network (WAN), wireless local area network (WLAN), virtual private network (VPN), intranet, or any other appropriate architecture or system that facilitates communications in a network or telephonic environment.
  • PDN packet data network
  • Operational agents 324 are one or more computing engines that may include one or more nontransitory computer-readable mediums having stored thereon executable instructions operable to instruct a processor to provide operational functions.
  • processor 310 may retrieve a copy of operational agents 324 (or software portions thereof) from storage 350 and load it into memory 320.
  • Processor 310 may then iteratively execute the instructions of operational agents 324 to provide the desired methods or functions.
  • an "engine” includes any combination of one or more logic elements, of similar or dissimilar species, operable for and configured to perform one or more methods provided by the engine.
  • the engine may include a special integrated circuit designed to carry out a method or a part thereof, a field-programmable gate array (FPGA) programmed to provide a function, other programmable logic, and/or software instructions operable to instruct a processor to perform the method.
  • FPGA field-programmable gate array
  • the engine may run as a "daemon” process, background process, terminate-and-stay-resident program, a service, system extension, control panel, bootup procedure, basic input/output system (BIOS) subroutine, or any similar program that operates with or without direct user interaction.
  • BIOS basic input/output system
  • some engines may run with elevated privileges in a "driver space" associated with ring 0, 1, or 2 in a protection ring architecture.
  • the engine may also include other hardware and software, including configuration files, registry entries, application programming interfaces (APIs), and interactive or user-mode software by way of nonlimiting example.
  • APIs application programming interfaces
  • Peripheral interface 340 may be configured to interface with any auxiliary device that connects to hardware platform 300 but that is not necessarily a part of the core architecture of hardware platform 300.
  • a peripheral may be operable to provide extended functionality to hardware platform 300, and may or may not be wholly dependent on hardware platform 300.
  • a peripheral may be a computing device in its own right.
  • Peripherals may include input and output devices such as displays, terminals, printers, keyboards, mice, modems, data ports (e.g., serial, parallel, universal serial bus (USB), Firewire, or similar), network controllers, optical media, external storage, sensors, transducers, actuators, controllers, data acquisition buses, cameras, microphones, speakers, or external storage, by way of nonlimiting example.
  • peripherals include display adapter 342, audio driver 344, and input/output (I/O) driver 346.
  • Display adapter 342 may be configured to provide a human-readable visual output, such as a command-line interface (CLI) or graphical desktop such as Microsoft Windows, Apple OSX desktop, or a Unix/Linux X Window System-based desktop.
  • Display adapter 342 may provide output in any suitable format, such as a coaxial output, composite video, component video, video graphic array (VGA), or digital outputs such as digital visual interface (DVI) or high definition multimedia interface (HDMI), by way of nonlimiting example.
  • display adapter 342 may include a hardware graphics card, which may have its own memory and its own graphics processing unit (GPU).
  • Audio driver 344 may provide an interface for audible sounds, and may include in some examples a hardware sound card. Sound output may be provided in analog (such as a 3.5mm stereo jack), component ("RCA") stereo, or in a digital audio format such as S/PDIF, AES3, AES47, HDMI, USB, Bluetooth or Wi-Fi audio, by way of nonlimiting example.
  • analog such as a 3.5mm stereo jack
  • RCA component
  • Digital audio format such as S/PDIF, AES3, AES47, HDMI, USB, Bluetooth or Wi-Fi audio, by way of nonlimiting example.
  • FIGURE 4 is a block diagram of a home gateway 400, according to one or more examples of the present specification.
  • Home gateway 400 operates on a hardware platform 402, which may include, for example, some or all of the elements illustrated in hardware platform 300 of FIGURE 3 .
  • a firewall 404 Operating on hardware platform 402 are various home gateway functions, including, for example, a firewall 404, routing and switching functions 424, and a DHCP server 428. Note that these are illustrated here as part of a home gateway, and are commonly included with such home gateways. But these should be understood to be nonlimiting examples. In other embodiments, particularly in an enterprise context, it is common for some or all of these functions to be provided by dedicated hardware or virtual appliances that perform a single function.
  • DHCP server 428 may include a DHCP reservation table 432, and may dynamically assign IP addresses to various hosts that connect on an internal network.
  • DHCP server 428 is provided as a nonlimiting example only, and other configurations are possible, including self-assigned IP addresses and static IP address assignments.
  • One benefit of using a DHCP reservation table 432 is that a host can consistently be assigned the same IP address based on its unchanging media access control (MAC) address. This can be useful if the APRT relies on IP addresses for its rules. Note, however, that this is a nonlimiting example. In other examples, the APRT could be based on a MAC address, or could correspond a MAC address to an IP address, and thus may be able to dynamically self-update as IP address assignments change.
  • MAC media access control
  • Routing and switching functions 424 are common functions of a home gateway, and are provided to direct traffic from an ingress interface to an egress interface, based on certain port forwarding or port assignment rules. Such routing and switching functions are well understood in the art.
  • Firewall 404 is a similarly well-known function that isolates intranet traffic from extranet traffic. Firewall 404 may employ port forwarding rules 412, which in some embodiments may be used to forward certain ports to destination devices so that they can handle incoming traffic. This can be useful, for example, in cases where it is desirable for a login interface of a particular device to be accessible via an extranet, such as the Internet.
  • Access proxy engine 416 is an engine as described in connection with FIGURE 3 .
  • Access proxy engine 416 employs an access proxy rules table 420, and provides the logic for intercepting incoming traffic requests and identifying them as access requests, directed to IoT devices in the network.
  • access proxy engine 416 may identify incoming requests as device access requests based on HTML tags, HTTP or HTTPS ports, URLs, or other data that identify a request as a device access request.
  • Access proxy engine 416 may be configured to perform functions or methods, such as methods 500 of FIGURE 5 and 600 of FIGURE 6 , in addition to other methods consistent with the present specification.
  • access proxy engine 416 may be provided as a software or firmware program provided on one or more tangible, non-transitory computer readable storage mediums having stored thereon instructions, microcode, or other data for programming a processor or other programmable device to carry out the functions. Also note that access proxy engine 416 could be provided by separate hardware, a processor, a coprocessor, an ASIC, an FPGA, or any other suitable hardware and/or software device.
  • FIGURE 5 is a flowchart of a method 500, according to one or more examples of the present specification.
  • Method 500 may be performed by any suitable device or logic function, including, for example, by an access proxy engine 416 as illustrated in FIGURE 4 .
  • FIGURE 5 illustrates a method of scanning, identifying, and configuring a new IoT device that is discovered on the network. This could be the result of a periodic scan, or the result of identifying a new device as it requests an IP address via DHCP, or via other means.
  • the system detects that a new IoT device has been added, as shown in block 504.
  • the system may probe the new device for access interfaces. As discussed above, this could be via a dictionary of common access interfaces, including common usernames and password combinations that may be provided for those interfaces. This could include probing for HTML, extensible markup language (XML), PHP, ASP, or other similar data structures with names like "index,” “default,” “main,” or similar that are commonly used. Common username and password combinations could also be tried.
  • the system may have access to a database that includes known default username and password combinations.
  • a security services provider such as security services provider 190 of FIGURE 1 , could maintain such a database, in which case the system could query the security services provider for a known username and password combination, or possible username and password combinations for a particular device and model.
  • the system determines whether a known interface was discovered. If no known interfaces were discovered, then in block 520, the system may prompt the user for input. This may allow the user, for example, to consult product literature or other resources to identify the default username and password. Also note that in some cases, the default username and password may not be necessary, for example, if a tiered access structure is desired, wherein the user authenticates to the home gateway, and then separately authenticates to the device.
  • the system configures an access interface proxy for that particular access interface.
  • the system stores the interface proxy rules, for example, in APRT 532.
  • FIGURE 6 is a flowchart illustrating a method 600 which may be performed, for example, by an access proxy engine 416 or other suitable hardware or software, according to one or more examples of the present specification.
  • the system intercepts an incoming access request 604. This may occur, for example, when the user attempts to access a resource on a particular device.
  • the system determines whether the resource being accessed is a known resource, for example, a resource that already has an existing entry in an APRT.
  • the system determines whether there is an existing session token for this resource. For example, if the user has recently accessed the resource, there may be an existing session, which may mean that there is not a need to authenticate to the home gateway at this time. If there is an existing session token, then in decision block 632, the system determines whether the current access scope is compatible with the existing session. For example, if the session was established within the intranet, and the current access is from the extranet, the access may be incompatible.
  • the system provides the access checkpoint interface, for example, requiring the user to authenticate to the home gateway as described herein.
  • decision block 616 the system determines whether this is a candidate resource for interception. If this is not a candidate resource, then in block 644, the user is redirected to the original resource, and in block 698, the method is done.
  • an entry for this resource may be added to the APRT.
  • the system provides the access checkpoint interface to the user. This may require the user to enter credentials, such as those used to log into the home gateway itself.
  • credentials such as those used to log into the home gateway itself.
  • the strength of authentication or the method of authentication may be varied. For example, for more sensitive resources, two-factor authentication, biometric authentication, token authentication, or other stronger authentication than a simple username and password may be required.
  • the username and password for the router may be used, while for more serious or severe resources, a separate username and password, which may have stronger security requirements, may be required.
  • block 636 it is determined whether the user has successfully passed the checkpoint control, whatever that entails in this context. If not, then control may return to block 628. Note, however, that in some embodiments, too many unsuccessful access requests may result in a lockout, which may timeout after a certain amount of time, such as one minute, ten minutes, one hour, 24 hours, or some other time.
  • the system creates a session token for this resource. This may ease access to the resource later if the user continues to access the resource over time.
  • This specification may provide illustrations in a block diagram format, wherein certain features are disclosed in separate blocks. These should be understood broadly to disclose how various features interoperate, but are not intended to imply that those features must necessarily be embodied in separate hardware or software. Furthermore, where a single block discloses more than one feature in the same block, those features need not necessarily be embodied in the same hardware and/or software.
  • a computer "memory" could in some circumstances be distributed or mapped between multiple levels of cache or local memory, main memory, battery-backed volatile memory, and various forms of persistent memory such as a hard disk, storage server, optical disk, tape drive, or similar. In certain embodiments, some of the components may be omitted or consolidated.
  • a "computer-readable medium” should be understood to include one or more computer-readable mediums of the same or different types.
  • a computer-readable medium may include, by way of non-limiting example, an optical drive (e.g., CD/DVD/Blu-Ray), a hard drive, a solid-state drive, a flash memory, or other non-volatile medium.
  • a computer-readable medium could also include a medium such as a read-only memory (ROM), an FPGA or ASIC configured to carry out the desired instructions, stored instructions for programming an FPGA or ASIC to carry out the desired instructions, an intellectual property (IP) block that can be integrated in hardware into other circuits, or instructions encoded directly into hardware or microcode on a processor such as a microprocessor, digital signal processor (DSP), microcontroller, or in any other suitable component, device, element, or object where appropriate and based on particular needs.
  • a nontransitory storage medium herein is expressly intended to include any nontransitory special-purpose or programmable hardware configured to provide the disclosed operations, or to cause a processor to perform the disclosed operations.
  • Various elements may be "communicatively,” “electrically,” “mechanically,” or otherwise “coupled” to one another throughout this specification and the claims. Such coupling may be a direct, point-to-point coupling, or may include intermediary devices. For example, two devices may be communicatively coupled to one another via a controller that facilitates the communication. Devices may be electrically coupled to one another via intermediary devices such as signal boosters, voltage dividers, or buffers. Mechanically-coupled devices may be indirectly mechanically coupled.
  • module or “engine” disclosed herein may refer to or include software, a software stack, a combination of hardware, firmware, and/or software, a circuit configured to carry out the function of the engine or module, or any computer-readable medium as disclosed above.
  • modules or engines may, in appropriate circumstances, be provided on or in conjunction with a hardware platform, which may include hardware compute resources such as a processor, memory, storage, interconnects, networks and network interfaces, accelerators, or other suitable hardware.
  • Such a hardware platform may be provided as a single monolithic device (e.g., in a PC form factor), or with some or part of the function being distributed (e.g., a "composite node" in a high-end data center, where compute, memory, storage, and other resources may be dynamically allocated and need not be local to one another).
  • a Composite node in a high-end data center, where compute, memory, storage, and other resources may be dynamically allocated and need not be local to one another).
  • SoC system-on-a-chip
  • CPU central processing unit
  • An SoC represents an integrated circuit (IC) that integrates components of a computer or other electronic system into a single chip.
  • client devices or server devices may be provided, in whole or in part, in an SoC.
  • the SoC may contain digital, analog, mixed-signal, and radio frequency functions, all of which may be provided on a single chip substrate.
  • Other embodiments may include a multichip module (MCM), with a plurality of chips located within a single electronic package and configured to interact closely with each other through the electronic package.
  • MCM multichip module
  • any suitably-configured circuit or processor can execute any type of instructions associated with the data to achieve the operations detailed herein.
  • Any processor disclosed herein could transform an element or an article (for example, data) from one state or thing to another state or thing.
  • the information being tracked, sent, received, or stored in a processor could be provided in any database, register, table, cache, queue, control list, or storage structure, based on particular needs and implementations, all of which could be referenced in any suitable timeframe.
  • Any of the memory or storage elements disclosed herein, should be construed as being encompassed within the broad terms "memory" and "storage,” as appropriate.
  • Computer program logic implementing all or part of the functionality described herein is embodied in various forms, including, but in no way limited to, a source code form, a computer executable form, machine instructions or microcode, programmable hardware, and various intermediate forms (for example, forms generated by an assembler, compiler, linker, or locator).
  • source code includes a series of computer program instructions implemented in various programming languages, such as an object code, an assembly language, or a high-level language such as OpenCL, FORTRAN, C, C++, JAVA, or HTML for use with various operating systems or operating environments, or in hardware description languages such as Spice, Verilog, and VHDL.
  • the source code may define and use various data structures and communication messages.
  • the source code may be in a computer executable form (e.g., via an interpreter), or the source code may be converted (e.g., via a translator, assembler, or compiler) into a computer executable form, or converted to an intermediate form such as byte code.
  • any of the foregoing may be used to build or describe appropriate discrete or integrated circuits, whether sequential, combinatorial, state machines, or otherwise.
  • any number of electrical circuits of the FIGURES may be implemented on a board of an associated electronic device.
  • the board can be a general circuit board that can hold various components of the internal electronic system of the electronic device and, further, provide connectors for other peripherals.
  • Any suitable processor and memory can be suitably coupled to the board based on particular configuration needs, processing demands, and computing designs. Note that with the numerous examples provided herein, interaction may be described in terms of two, three, four, or more electrical components. However, this has been done for purposes of clarity and example only. It should be appreciated that the system can be consolidated or reconfigured in any suitable manner.
  • any of the illustrated components, modules, and elements of the FIGURES may be combined in various possible configurations, all of which are within the broad scope of this specification.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Claims (14)

  1. Procédé mis en oeuvre par ordinateur, exécuté par un dispositif passerelle, comprenant les étapes consistant à :
    intercepter (608) un paquet entrant provenant d'un dispositif client ;
    déterminer que le paquet entrant est une demande d'accès dirigée vers une interface d'accès d'une ressource d'un intranet ;
    fournir (628) une interface de point de contrôle d'accès au dispositif client ;
    recevoir une réponse d'entrée d'authentification ;
    valider (636) la réponse d'entrée d'authentification ; et
    fournir (644) une redirection du dispositif client à l'interface d'accès de la ressource, selon une table de règles de mandataire d'accès, APRT, indiquant, pour la ressource, un dispositif sur lequel la ressource est disponible.
  2. Procédé selon la revendication 1, dans lequel l'APRT indique également une politique de sécurité concernant la ressource.
  3. Procédé selon la revendication 1 ou la revendication 2, comprenant également l'étape consistant à
    stocker des références d'identification de connexion pour la ressource et effectuer une action de connexion avant de fournir la redirection.
  4. Procédé selon l'une quelconque des revendications 1 à 3, comprenant également l'étape consistant à :
    déterminer s'il existe un jeton de session pour la ressource, si la ressource est une ressource connue pour laquelle il existe une entrée dans l'APRT.
  5. Procédé selon l'une quelconque des revendications 1 à 3, comprenant également les étapes consistant à :
    déterminer qu'il n'existe pas d'entrée dans l'APRT pour la ressource ; et
    créer une entrée pour la ressource dans l'APRT.
  6. Procédé selon l'une quelconque des revendications 2 à 5, dans lequel l'APRT comprend également un champ de sévérité, le champ de sévérité correspondant à un degré de rigueur de la politique de sécurité concernant la ressource, le procédé comprenant également l'étape consistant à faire varier, par l'interface de point de contrôle d'accès, une force ou un procédé de l'authentification et/ou une longueur d'une session sur la base du champ de sévérité.
  7. Procédé selon l'une quelconque des revendications 1 à 6, comprenant également l'étape consistant à :
    établir une session pour l'accès à la ressource.
  8. Procédé selon l'une quelconque des revendications 1 à 7, comprenant également l'étape consistant à :
    entrer, par le dispositif passerelle, des références d'identification pour la ressource, sur la base d'une validation de la réponse d'entrée d'authentification, dans lequel l'interface de point de contrôle d'accès demande la réponse d'entrée d'authentification.
  9. Procédé selon l'une quelconque des revendications 1 à 8, dans lequel la ressource est un dispositif d'Internet des objets (IoT).
  10. Appareil comprenant des moyens pour effectuer le procédé selon l'une quelconque des revendications précédentes.
  11. Appareil selon la revendication 10, dans lequel les moyens pour effectuer le procédé comprennent un processeur et une mémoire.
  12. Appareil selon la revendication 11, dans lequel la mémoire comprend des instructions lisibles par machine qui, lorsqu'elles sont exécutées, amènent l'appareil à effectuer le procédé selon l'une quelconque des revendications 1 à 9.
  13. Appareil selon l'une quelconque des revendications 10 à 12, l'appareil étant un système informatique.
  14. Au moins un support lisible par ordinateur comprenant des instructions qui, lorsqu'elles sont exécutées, mettent en oeuvre un procédé selon l'une quelconque des revendications 1 à 9.
EP19756785.2A 2018-02-26 2019-02-25 Passerelle à point de contrôle d'accès Active EP3759886B1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US15/905,606 US10728218B2 (en) 2018-02-26 2018-02-26 Gateway with access checkpoint
PCT/US2019/019335 WO2019165336A1 (fr) 2018-02-26 2019-02-25 Passerelle à point de contrôle d'accès

Publications (3)

Publication Number Publication Date
EP3759886A1 EP3759886A1 (fr) 2021-01-06
EP3759886A4 EP3759886A4 (fr) 2021-11-03
EP3759886B1 true EP3759886B1 (fr) 2024-01-10

Family

ID=67684846

Family Applications (1)

Application Number Title Priority Date Filing Date
EP19756785.2A Active EP3759886B1 (fr) 2018-02-26 2019-02-25 Passerelle à point de contrôle d'accès

Country Status (4)

Country Link
US (2) US10728218B2 (fr)
EP (1) EP3759886B1 (fr)
CN (1) CN111742533B (fr)
WO (1) WO2019165336A1 (fr)

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10728218B2 (en) 2018-02-26 2020-07-28 Mcafee, Llc Gateway with access checkpoint
US10972314B2 (en) * 2019-06-25 2021-04-06 Honeywell International Inc. Gateway device for a fire control system
DE102019209888A1 (de) * 2019-07-04 2021-01-07 BSH Hausgeräte GmbH System und Verfahren zur Authentifizierung an einem Gerät
CN113014530B (zh) * 2019-12-19 2023-06-13 中国航发上海商用航空发动机制造有限责任公司 Arp欺骗攻击防范方法及系统
WO2021263222A1 (fr) * 2020-06-26 2021-12-30 Calyptix Security Corporation Sécurisation d'accès à des dispositifs de réseau utilisant une authentification à deux facteurs et des règles de pare-feu temporaires générées dynamiquement
CA3193328A1 (fr) * 2020-07-31 2022-02-03 Reimer MARK Reseau de dispositifs de securite automatique
US11381604B2 (en) 2020-08-03 2022-07-05 Bank Of America Corporation Resilient self-detection of malicious exfiltration of sensitive data
US20230308467A1 (en) * 2022-03-24 2023-09-28 At&T Intellectual Property I, L.P. Home Gateway Monitoring for Vulnerable Home Internet of Things Devices

Family Cites Families (71)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7821926B2 (en) * 1997-03-10 2010-10-26 Sonicwall, Inc. Generalized policy server
US6185567B1 (en) 1998-05-29 2001-02-06 The Trustees Of The University Of Pennsylvania Authenticated access to internet based research and data services
US6799177B1 (en) 1999-05-05 2004-09-28 Verizon Corporate Services Group Inc. Systems and methods for securing extranet transactions
US6463474B1 (en) * 1999-07-02 2002-10-08 Cisco Technology, Inc. Local authentication of a client at a network device
US6842460B1 (en) * 2001-06-27 2005-01-11 Nokia Corporation Ad hoc network discovery menu
US20110301982A1 (en) * 2002-04-19 2011-12-08 Green Jr W T Integrated medical software system with clinical decision support
US8397988B1 (en) 2002-08-09 2013-03-19 Britesmart Llc Method and system for securing a transaction using a card generator, a RFID generator, and a challenge response protocol
US7735129B2 (en) * 2003-02-05 2010-06-08 Nippon Telegraph And Telephone Corporation Firewall device
US8091117B2 (en) * 2003-02-14 2012-01-03 Preventsys, Inc. System and method for interfacing with heterogeneous network data gathering tools
EP1507402A3 (fr) * 2003-06-23 2005-07-20 Ricoh Company, Ltd. Système de décision et d'imposition de commande d'acces, et ligne de conduite de sécurité
US7703073B2 (en) * 2004-06-08 2010-04-20 Covia Labs, Inc. Device interoperability format rule set and method for assembling interoperability application package
US8272032B2 (en) * 2004-11-10 2012-09-18 Mlb Advanced Media, L.P. Multiple user login detection and response system
US8074259B1 (en) * 2005-04-28 2011-12-06 Sonicwall, Inc. Authentication mark-up data of multiple local area networks
CN100477650C (zh) * 2005-09-30 2009-04-08 华为技术有限公司 下一代网络中的ip互通网关及其实现ip域互通的方法
US20070288247A1 (en) * 2006-06-11 2007-12-13 Michael Mackay Digital life server
CA2689479A1 (fr) * 2007-06-04 2008-12-11 Bce Inc. Procedes et systemes pour valider des transactions en ligne a l'aide d'informations de position
US9619616B2 (en) * 2007-07-03 2017-04-11 Eingot Llc Records access and management
US8600776B2 (en) * 2007-07-03 2013-12-03 Eingot Llc Records access and management
US8359467B2 (en) * 2007-07-07 2013-01-22 Hewlett-Packard Development Company, L.P. Access control system and method
CN101262368B (zh) * 2008-03-17 2012-03-28 中兴通讯股份有限公司 家庭网关路由模式连接配置的方法及装置
CN201252570Y (zh) * 2008-08-29 2009-06-03 公安部第三研究所 一种安全网关客户端装置
US20110087888A1 (en) * 2009-10-13 2011-04-14 Google Inc. Authentication using a weak hash of user credentials
US20110142234A1 (en) * 2009-12-15 2011-06-16 Michael Leonard Rogers Multi-Factor Authentication Using a Mobile Phone
US20120084348A1 (en) * 2009-12-30 2012-04-05 Wei-Yeh Lee Facilitation of user management of unsolicited server operations
US20120078727A1 (en) * 2009-12-30 2012-03-29 Wei-Yeh Lee Facilitation of user management of unsolicited server operations via modification thereof
US20120084349A1 (en) * 2009-12-30 2012-04-05 Wei-Yeh Lee User interface for user management and control of unsolicited server operations
US20120084151A1 (en) * 2009-12-30 2012-04-05 Kozak Frank J Facilitation of user management of unsolicited server operations and extensions thereto
US8843998B2 (en) * 2011-06-27 2014-09-23 Cliqr Technologies, Inc. Apparatus, systems and methods for secure and selective access to services in hybrid public-private infrastructures
US9749291B2 (en) 2011-07-15 2017-08-29 International Business Machines Corporation Securing applications on public facing systems
KR20130046155A (ko) * 2011-10-27 2013-05-07 인텔렉추얼디스커버리 주식회사 클라우드 컴퓨팅 서비스에서의 접근제어 시스템
CN102694704B (zh) * 2012-05-08 2015-07-15 北京邮电大学 一种家庭网关及其区分用户身份的方法
US9549333B2 (en) * 2012-06-01 2017-01-17 Turk Telekomunikasyon A.S. Method and device for monitoring and measurement of Wi-Fi internet services
US9223950B2 (en) * 2013-03-05 2015-12-29 Intel Corporation Security challenge assisted password proxy
US9465942B1 (en) * 2013-04-08 2016-10-11 Amazon Technologies, Inc. Dictionary generation for identifying coded credentials
US9590884B2 (en) * 2013-07-03 2017-03-07 Facebook, Inc. Native application hotspot
US9396319B2 (en) 2013-09-30 2016-07-19 Laird H. Shuart Method of criminal profiling and person identification using cognitive/behavioral biometric fingerprint analysis
US9294462B2 (en) * 2014-01-15 2016-03-22 Cisco Technology, Inc. Redirect to inspection proxy using single-sign-on bootstrapping
US9794227B2 (en) * 2014-03-07 2017-10-17 Microsoft Technology Licensing, Llc Automatic detection of authentication methods by a gateway
US10375024B2 (en) * 2014-06-20 2019-08-06 Zscaler, Inc. Cloud-based virtual private access systems and methods
US10616180B2 (en) * 2014-06-20 2020-04-07 Zscaler, Inc. Clientless connection setup for cloud-based virtual private access systems and methods
US10114939B1 (en) * 2014-09-22 2018-10-30 Symantec Corporation Systems and methods for secure communications between devices
CN104580233B (zh) * 2015-01-16 2017-09-01 重庆邮电大学 一种物联网智能家居安全网关系统
US9967351B2 (en) * 2015-01-31 2018-05-08 Splunk Inc. Automated service discovery in I.T. environments
US10205712B2 (en) * 2015-06-10 2019-02-12 Mcafee, Llc Sentinel appliance in an internet of things realm
US9961062B2 (en) * 2015-07-21 2018-05-01 Sap Se Centralized authentication server for providing cross-domain resources via a rest-based tunnel
US9930034B2 (en) * 2015-07-29 2018-03-27 International Business Machines Corporation Authenticating applications using a temporary password
US9450944B1 (en) * 2015-10-14 2016-09-20 FullArmor Corporation System and method for pass-through authentication
US10397331B2 (en) * 2016-01-29 2019-08-27 General Electric Company Development platform for industrial internet applications
US10623376B2 (en) * 2016-01-29 2020-04-14 Zenedge, Inc. Qualifying client behavior to mitigate attacks on a host
US10397235B2 (en) * 2016-02-01 2019-08-27 General Electric Company Event processing via industrial asset cloud computing system
US10327185B2 (en) * 2016-03-18 2019-06-18 Parallel Wireless, Inc. IuGW architecture with RTP localization
US10616249B2 (en) * 2016-03-31 2020-04-07 Intel Corporation Adaptive internet of things edge device security
US11388597B2 (en) * 2016-04-21 2022-07-12 Signify Holding B.V. Systems and methods for authenticating wireless modules
US20220029965A1 (en) * 2016-05-18 2022-01-27 Zscaler, Inc. Scaling private application access support per client
DE112016006827T5 (de) * 2016-07-01 2019-03-07 Intel Corporation Gruppenverwaltung in rekonfigurierbaren maschine-zu-maschine-systemen
US10609180B2 (en) * 2016-08-05 2020-03-31 At&T Intellectual Property I, L.P. Facilitating dynamic establishment of virtual enterprise service platforms and on-demand service provisioning
KR102633995B1 (ko) * 2016-08-22 2024-02-06 삼성전자 주식회사 무선 통신 시스템에서, 단말과 써드 파티 서버 간의 인증 요청 방법 및, 이를 위한 단말 및 네트워크 슬라이스 인스턴스 관리 장치
US20180095439A1 (en) * 2016-10-03 2018-04-05 Rouzbeh Karbasian Universal device communication and configuration
US10523678B2 (en) * 2016-10-25 2019-12-31 Sean Dyon System and method for architecture initiated network access control
US10333963B2 (en) * 2016-10-28 2019-06-25 Corax Cyber Security, Inc. Identifying a vulnerability of an asset of a network infrastructure to mitigate
US10484369B2 (en) * 2016-10-31 2019-11-19 Ncr Corporation Voice authentication via secondary device
TWI764971B (zh) * 2016-12-30 2022-05-21 美商英特爾公司 物聯網
US10164983B2 (en) * 2017-01-20 2018-12-25 Verizon Patent And Licensing Inc. Distributed authentication for internet-of-things resources
EP3501155B1 (fr) * 2017-01-27 2023-06-07 Telefonaktiebolaget LM Ericsson (publ) Authentification secondaire d'un équipement utilisateur
US10616067B2 (en) * 2017-06-27 2020-04-07 Amazon Technologies, Inc. Model and filter deployment across IoT networks
US11350360B2 (en) * 2017-06-27 2022-05-31 Amazon Technologies, Inc. Generating adaptive models for IoT networks
US10482258B2 (en) * 2017-09-29 2019-11-19 Nxp Usa, Inc. Method for securing runtime execution flow
US10104077B1 (en) * 2017-10-06 2018-10-16 Xage Security, Inc. Enabling multitenant data access on a single industrial network
US10681085B2 (en) * 2017-10-16 2020-06-09 International Business Machines Corporation Quick transport layer security/secure sockets layer connection for internet of things devices
US11012495B1 (en) * 2018-01-09 2021-05-18 EMC IP Holding Company LLC Remote service credentials for establishing remote sessions with managed devices
US10728218B2 (en) 2018-02-26 2020-07-28 Mcafee, Llc Gateway with access checkpoint

Also Published As

Publication number Publication date
CN111742533B (zh) 2023-05-09
US20190268307A1 (en) 2019-08-29
WO2019165336A1 (fr) 2019-08-29
US10728218B2 (en) 2020-07-28
EP3759886A1 (fr) 2021-01-06
CN111742533A (zh) 2020-10-02
EP3759886A4 (fr) 2021-11-03
US20200322314A1 (en) 2020-10-08
US11558355B2 (en) 2023-01-17

Similar Documents

Publication Publication Date Title
EP3759886B1 (fr) Passerelle à point de contrôle d'accès
US11711399B2 (en) Policy enforcement for secure domain name services
US11632254B2 (en) Home or enterprise router-based secure domain name services
US11711345B2 (en) Split tunnel-based security
US11362999B2 (en) Client-only virtual private network
US10554624B2 (en) Proxy authentication for single sign-on
US11881938B2 (en) Provisioning of encrypted DNS services
KR20190015273A (ko) 하드웨어 기반의 가상화된 보안 격리 기법
US11689562B2 (en) Detection of ransomware
US20210203521A1 (en) Device identification
US11917080B2 (en) Secure attestation of endpoint capability
US11100225B2 (en) Scanning of encrypted zip files
US11405237B2 (en) Unencrypted client-only virtual private network
US11930359B2 (en) Wireless access point with multiple security modes
US11599675B2 (en) Detecting data leakage to websites accessed using a remote browsing infrastructure
US11824645B2 (en) Agentless security services
US11463440B2 (en) Cloud-based shared security cache
US20210342446A1 (en) Cache system for consistent retrieval of related objects
US11411991B2 (en) User activity-triggered URL scan

Legal Events

Date Code Title Description
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE

PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20200824

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: MCAFEE, LLC

DAV Request for validation of the european patent (deleted)
DAX Request for extension of the european patent (deleted)
A4 Supplementary search report drawn up and despatched

Effective date: 20210930

RIC1 Information provided on ipc code assigned before grant

Ipc: H04L 12/28 20060101ALI20210924BHEP

Ipc: H04L 12/66 20060101ALI20210924BHEP

Ipc: H04L 29/06 20060101AFI20210924BHEP

REG Reference to a national code

Ref document number: 602019044906

Country of ref document: DE

Ref country code: DE

Ref legal event code: R079

Free format text: PREVIOUS MAIN CLASS: H04L0029060000

Ipc: H04L0012660000

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

RIC1 Information provided on ipc code assigned before grant

Ipc: H04L 9/40 20220101ALI20230707BHEP

Ipc: H04L 12/28 20060101ALI20230707BHEP

Ipc: H04L 12/66 20060101AFI20230707BHEP

INTG Intention to grant announced

Effective date: 20230724

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602019044906

Country of ref document: DE

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

P01 Opt-out of the competence of the unified patent court (upc) registered

Effective date: 20240109

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20240124

Year of fee payment: 6

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG9D

REG Reference to a national code

Ref country code: NL

Ref legal event code: MP

Effective date: 20240110

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20240110

Year of fee payment: 6

REG Reference to a national code

Ref country code: AT

Ref legal event code: MK05

Ref document number: 1649749

Country of ref document: AT

Kind code of ref document: T

Effective date: 20240110

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240110

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240110

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240510